1*fe8777a8SShuah KhanTesting for regressions in Media Controller API register, ioctl, syscall, 2*fe8777a8SShuah Khanand unregister paths. There have a few problems that result in user-after 3*fe8777a8SShuah Khanfree on media_device, media_devnode, and cdev pointers when the driver is 4*fe8777a8SShuah Khanunbound while ioctl is in progress. 5*fe8777a8SShuah Khan 6*fe8777a8SShuah KhanTest Procedure: 7*fe8777a8SShuah Khan 8*fe8777a8SShuah KhanRun bin/unbind loop while ioctls are in progress. 9*fe8777a8SShuah KhanRun rmmod and modprobe. 10*fe8777a8SShuah KhanDisconnect the device. 11*fe8777a8SShuah Khan 12*fe8777a8SShuah KhanSetup: 13*fe8777a8SShuah Khan 14*fe8777a8SShuah KhanBuild media_device_test 15*fe8777a8SShuah Khancd tools/testing/selftests/media_tests 16*fe8777a8SShuah Khanmake 17*fe8777a8SShuah Khan 18*fe8777a8SShuah KhanRegressions test for cdev user-after free error on /dev/mediaX when driver 19*fe8777a8SShuah Khanis unbound: 20*fe8777a8SShuah Khan 21*fe8777a8SShuah KhanStart media_device_test to regression test media devnode dynamic alloc 22*fe8777a8SShuah Khanand cdev user-after-free fixes. This opens media dev files and sits in 23*fe8777a8SShuah Khana loop running media ioctl MEDIA_IOC_DEVICE_INFO command once every 10 24*fe8777a8SShuah Khanseconds. The idea is when device file goes away, media devnode and cdev 25*fe8777a8SShuah Khanshould stick around until this test exits. 26*fe8777a8SShuah Khan 27*fe8777a8SShuah KhanThe test for a random number of iterations or until user kills it with a 28*fe8777a8SShuah Khansleep 10 in between the ioctl calls. 29*fe8777a8SShuah Khan 30*fe8777a8SShuah Khansudo ./media_device_test -d /dev/mediaX 31*fe8777a8SShuah Khan 32*fe8777a8SShuah KhanRegression test for media_devnode unregister race with ioctl_syscall: 33*fe8777a8SShuah Khan 34*fe8777a8SShuah KhanStart 6 open_loop_test.sh tests with different /dev/mediaX files. When 35*fe8777a8SShuah Khandevice file goes away after unbind, device file name changes. Start the 36*fe8777a8SShuah Khantest with possible device names. If we start with /dev/media0 for example, 37*fe8777a8SShuah Khanafter unbind, /dev/media1 or /dev/media2 could get created. The idea is 38*fe8777a8SShuah Khankeep ioctls going while bind/unbind runs. 39*fe8777a8SShuah Khan 40*fe8777a8SShuah KhanCopy bind_unbind_sample.txt and make changes to specify the driver name 41*fe8777a8SShuah Khanand number to run bind and unbind. Start the bind_unbind.sh 42*fe8777a8SShuah Khan 43*fe8777a8SShuah KhanRun dmesg looking for any user-after free errors or mutex lock errors. 44